US9619260B2 - Policy enforcement in a virtualized environment - Google Patents

Policy enforcement in a virtualized environment Download PDF

Info

Publication number
US9619260B2
US9619260B2 US14/677,858 US201514677858A US9619260B2 US 9619260 B2 US9619260 B2 US 9619260B2 US 201514677858 A US201514677858 A US 201514677858A US 9619260 B2 US9619260 B2 US 9619260B2
Authority
US
United States
Prior art keywords
virtual machine
machine instance
rule
dynamic address
address group
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
US14/677,858
Other versions
US20150277943A1 (en
Inventor
Song Wang
Martin Walter
Zhipu Jin
Wilson Xu
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Palo Alto Networks Inc
Original Assignee
Palo Alto Networks Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US13/528,748 priority Critical patent/US9047109B1/en
Application filed by Palo Alto Networks Inc filed Critical Palo Alto Networks Inc
Priority to US14/677,858 priority patent/US9619260B2/en
Publication of US20150277943A1 publication Critical patent/US20150277943A1/en
Application granted granted Critical
Publication of US9619260B2 publication Critical patent/US9619260B2/en
Application status is Active legal-status Critical
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/455Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533Hypervisors; Virtual machine monitors
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/455Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533Hypervisors; Virtual machine monitors
    • G06F9/45558Hypervisor-specific management and integration aspects
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/455Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533Hypervisors; Virtual machine monitors
    • G06F9/45558Hypervisor-specific management and integration aspects
    • G06F2009/45587Isolation or security of virtual machine instances

Abstract

Policy enforcement in an environment that includes virtualized systems is disclosed. Virtual machine information associated with a first virtual machine instance executing on a host machine is received. The information can be received from a variety of sources, including an agent, a log server, and a management infrastructure associated with the host machine. A policy is applied based at least in part on the received virtual machine information.

Description

CROSS REFERENCE TO OTHER APPLICATIONS

This application is a continuation of co-pending U.S. patent application Ser. No. 13/528,748, entitled POLICY ENFORCEMENT IN A VIRTUALIZED ENVIRONMENT filed Jun. 20, 2012 which is incorporated herein by reference for all purposes.

BACKGROUND OF THE INVENTION

Increasingly, businesses and other entities are using virtualized computing resources (whether running on purchased or leased computer hardware). Virtualized environments are generally very dynamic—virtual machines can easily be spun up, shut down, and moved. A given physical machine may support tens or hundreds of virtual machines and if that machine fails, the images running on the physical machine can be rapidly migrated to one or multiple other physical machines. Unfortunately, virtualized environments can pose problems for firewall rules which tend to rely on static information, such as static IP addresses.

BRIEF DESCRIPTION OF THE DRAWINGS

Various embodiments of the invention are disclosed in the following detailed description and the accompanying drawings.

FIG. 1 illustrates an embodiment of an environment that includes virtualized computing resources.

FIG. 2 illustrates an example of virtual machine information used in some embodiments.

FIG. 3 illustrates two examples of dynamic group definitions.

FIG. 4A illustrates an example of a policy.

FIG. 4B illustrates a conceptualized set of compiled rules.

FIG. 4C illustrates a conceptualized set of compiled rules.

FIG. 5 illustrates an embodiment of a data appliance.

FIG. 6 illustrates an example of a process for enforcing a policy.

FIG. 7 illustrates an example of a process for updating a rule.

DETAILED DESCRIPTION

The invention can be implemented in numerous ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer readable storage medium; and/or a processor, such as a processor configured to execute instructions stored on and/or provided by a memory coupled to the processor. In this specification, these implementations, or any other form that the invention may take, may be referred to as techniques. In general, the order of the steps of disclosed processes may be altered within the scope of the invention. Unless stated otherwise, a component such as a processor or a memory described as being configured to perform a task may be implemented as a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task. As used herein, the term ‘processor’ refers to one or more devices, circuits, and/or processing cores configured to process data, such as computer program instructions.

A detailed description of one or more embodiments of the invention is provided below along with accompanying figures that illustrate the principles of the invention. The invention is described in connection with such embodiments, but the invention is not limited to any embodiment. The scope of the invention is limited only by the claims and the invention encompasses numerous alternatives, modifications and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding of the invention. These details are provided for the purpose of example and the invention may be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the invention has not been described in detail so that the invention is not unnecessarily obscured.

FIG. 1 illustrates an embodiment of an environment that includes virtualized computing resources. As will be described in more detail below, policies can be enforced against those virtualized computing resources using the techniques described herein. In the example shown, enterprise network 126 includes various physical computing resources (e.g., server 110). Enterprise network 126 also includes three virtual servers (112-116), also referred to as “virtual machines,” running on a total of two hosts (106 and 108).

Communications between virtual servers 112-116 and resources outside of enterprise network 126 (e.g., communications received from laptop 132 via network 128) pass through data appliance 102, which is placed at the perimeter of enterprise network 126. Such communications may take place using any appropriate communication protocol such as Hypertext Transfer Protocol (HTTP), Secure Sockets Layer (SSL), and File Transfer Protocol (FTP). In the example shown in FIG. 1, data appliance 102 is a firewall and is configured to enforce policies (also referred to herein as “rules”) with respect to the communications it receives. Other types of devices can also be configured to provide the functionality described herein as being performed by data appliance 102. Examples include routers, gateways, intrusion detection systems, intrusion prevention systems, and other appropriate devices.

Other network topologies can also be used in conjunction with the techniques described herein. Examples of such topologies include networks having multiple data appliances; networks where at least some of the network nodes are located at a hosting company's data center; and networks in which data appliance 102 is configured to enforce policies with respect to traffic that stays within enterprise network 126 instead of or in addition to outside traffic.

As explained above, data appliance 102 is configured to enforce various policies. Such policies can apply to particular devices (e.g., virtual server 112), particular users, and/or groups (e.g., of devices or users). As one example, a policy can specify that access to virtual server 112 via HTTPS is permitted by anyone (including an arbitrary member of the public using laptop 132). As another example, a policy can specify that access to virtual server 116 via SSH is permitted by members of the Engineering group, and denied to anyone else. As yet another example, a policy can specify that virtual machines that are running the Ubuntu Linux operating system are allowed to communicate with known-malicious website 134 (e.g., because they are hardened research images), but no other nodes in network 126 are allowed to do so. Other types of actions can also be specified, such as policies requiring that certain types of access be logged. Other types of policies can also be specified, as applicable, such as quality of service policies, instead of or in addition to access/security policies.

Also included in the environment shown in FIG. 1 are agent 104 and log server 120, both of which are configured to collect virtual machine information (hereinafter “VM information”) from hosts, such as host 106, and to provide the information to data appliance 102. The virtual machine information can be collected in a variety of ways. For example, agent 104 can us an application programming interface (API) provided by the host operating system on host 106 to collect information about the virtual machines running on it (e.g., virtual machine 112). As another example, suppose host 108 lacks such an API. Host 108 can be configured to log information (including information pertaining to its virtual machines 114 and 116) to a log server 120. Log server 120 can be configured to provide the information to agent 104, which in turn provides the information to data appliance 102, or log server 120 can provide the information directly to data appliance 102 directly, as applicable. As will be described in more detail below, the collected VM information can be used by data appliance 102 to enforce policies.

As shown in FIG. 1, agent 104 is physically separate from data appliance 102. The functionality of agent 104 can also be incorporated into data appliance 102 (or another device) and standalone agent 104 (and/or log server 120) omitted as applicable.

FIG. 2 illustrates an example of virtual machine information used in some embodiments. Depicted in FIG. 2 are three sets of records 202-206—corresponding to each of virtual machines 112-116, respectively. The records shown are examples of information that can be obtained from VMware vCenter. Similar records can be obtained from other virtualization platforms, such as XenServer, and the techniques described herein adapted as applicable. Further, as needed, the information collected by log server 120 can be translated, converted, or otherwise manipulated so that the VM information it obtains is provided to data appliance 102 in an appropriate format.

Included in a given record, such as record 202, is various information pertaining to the virtual machine instance, such as the operating system (208), IPv4/IPv6 addresses (210, 212), and an identifier of the host (214). As will be described in more detail below, the information included in the records can be used by data appliance 102 to enforce policies.

The records can also be used to create dynamic groups (represented as “dynamic address objects”). Two examples of dynamic group definitions are depicted in FIG. 3. The first dynamic group (302) will include any virtual machine images on the portion of the enterprise network assigned to the Engineering department (306). The network (specifically, network=Engineering) is used as a filter. The second dynamic group (304) will include any virtual machine images running on host machine 108 (308). Multiple filters can also be combined, and Boolean or other operators can be employed to form more complex dynamic groups, such as a group that includes those virtual machines running a specific version of Windows 7 that are also either (a) running on host 106, and/or (b) are in the Sales network. Dynamic group definitions are configurable (e.g., by an administrator) and stored (148) in some embodiments on data appliance 102. In various embodiments, records, such as record 202, are augmented through the use of tags. For example, an administrator can specify a tag of “Windows” that is applicable to any version of a Windows-based operating system (e.g., Windows 95 and Windows 7). Such user-defined tags or other attributes can also be used as filters.

FIG. 4A illustrates an example of a policy. Policy 402 states that any virtual machine in the Engineering dynamic group is permitted to access any destination using SSH. Policy 402 is stored (142) on data appliance 102 and is editable by an administrator (e.g., of data appliance 102). The administrator does not need to provide the IP addresses or range of addresses of all of the Engineering computers when creating (or editing) the rule shown in FIG. 4A, but rather can use the abstracted dynamic address object “dyn-grp1.”

Policies, such as policy 402, are compiled (146) and, at runtime, used in enforcement by data appliance 102. Specifically, during compilation, the dynamic address object (“dyn-grp1”) will be replaced with the IP address of each virtual machine matching that group's definition, based on the information stored in VM information repository 144. As will be described in more detail below, when the IP address of a particular virtual machine changes (or when any other change implicating a rule is made), the VM information for the virtual machine in repository 144 will be updated, and any applicable firewall rules updated as well.

FIG. 4B illustrates a conceptualized set of compiled rules. In the example shown, policy 402 has been compiled, resulting in two rules—one for each of the virtual machines in the dynamic group, dyn-grp1. Specifically, the current IP addresses of virtual machines 112 (404) and 116 (406) are present.

Suppose virtual machine 112, which is shown in FIG. 1 as being hosted by host 106, is migrated to host 108 as indicated by line 130. One reason for the migration is if host 106 has a hardware or other failure. The IP address of virtual machine 112 changes as a result of the migration (i.e., from 172.16.0.4 to 10.5.125.34). FIG. 4C shows policy 402 as recompiled after virtual machine 112 is migrated. Specifically, IP address 404 has been changed (408) to reflect the current IP address of virtual machine 112 after migration.

FIG. 5 illustrates an embodiment of a data appliance. The example shown is a representation of physical components that can be included in data appliance 102. Specifically, data appliance 102 includes a high performance multi-core CPU 502 and RAM 504. Data appliance 102 also includes a storage 510 (such as one or more hard disks), which is used to store policy and other configuration information. Data appliance 102 can also include one or more optional hardware accelerators. For example, data appliance 102 can include a cryptographic engine 506 configured to perform encryption and decryption operations, and one or more FPGAs 508 configured to perform signature matching, act as network processors, and/or perform other tasks. Also included in data appliance 102 is interface 512. In some embodiments, interface 512 exposes an application programming interface (API) via which devices, such as agent 104 and log server 120, keep data appliance 102 apprised of current VM information.

FIG. 6 illustrates an example of a process for enforcing a policy. In some embodiments the process shown in FIG. 6 is performed by data appliance 102. The process begins at 602 when virtual machine information associated with a first virtual machine instance is received. As previously explained, VM information can be received in a variety of ways, from a variety of sources. As one example, VM information (including information pertaining to virtual machine 112) is received at 602 when agent 104 receives VM info from host 106 via an API. As another example, VM info is received at 602 when log server 120 provides information to data appliance 102 (or provides the information to agent 104 which in turn provides it to data appliance 102) pertaining to virtual machine 116 and/or virtual machine 114. The received information is stored in VM information repository 144.

As previously explained, the received VM info is used to compile rules (146) enforceable by data appliance 102. At 604, such rules (corresponding to policies) are enforced. As one example, at 604, policy 402 is enforced with respect to virtual machine 112, whose IP address (assuming the machine has not yet migrated) is included in compiled rule 404. As another example, if an image is cloned, policies can automatically be enforced against the new image based on any matches of attributes of that image's VM information with filters. Rules can be recompiled, as needed.

FIG. 7 illustrates an example of a process for updating a rule. In some embodiments the process shown in FIG. 7 is performed by data appliance 102. The process begins at 702 when an indication that information associated with a virtual machine instance has changed is received. The indication can be received in a variety of ways. As one example, when virtual machine 112 is migrated from host 106 to host 108, agent 104 may receive a push notification from host 106 regarding the migration event. Agent 104 then contacts host 108 (or log server 120, as applicable) to retrieve updated VM information for virtual machine 112 and provide it to data appliance 102 as an update (704). In some embodiments, when agent 104 receives the push notification from host 106, agent 104 instructs data appliance 102 to remove entry 202 from VM information repository 144. In that scenario, when the virtual machine image is brought up on host 108, host 108 (or log server 120, as applicable) notifies agent 104 (or data appliance 102, as applicable) of the presence of virtual machine 112 and a new record is created in VM information repository 144 as appropriate.

Indications of changes in VM information can also be received in other ways. For example, agent 104 can be configured to periodically pull information from sources such as log server 120, perform a diff or other comparison, and provide updates to data appliance 102.

At 706, a determination is made as to whether any firewall rules need to be recompiled based on the changed information. As one example, when virtual machine 112 migrates from host 106 to host 108, rule 404 will need to be recompiled (as rule 408) so that policy 402 continues to be satisfied. As another example, other attributes of a virtual machine might change, but, if such attributes are not used as filters (e.g., in any dynamic address objects), there will be no need to recompile any rules.

Finally, at 708, any implicated rules are recompiled.

Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not restrictive.

Claims (19)

What is claimed is:
1. A system, comprising:
a processor configured to:
receive a rule to be applied to network traffic associated with members of a dynamic address group;
receive virtual machine information associated with a first virtual machine instance executing on a host machine;
determine, based at least in part on at least a portion of the received virtual machine information, that the first virtual machine instance belongs to the dynamic address group;
in response to the determination, apply the rule to network traffic associated with the first virtual machine instance;
at a time subsequent to applying the rule to network traffic associated with the first virtual machine instance, determine that the rule should be recompiled into a recompiled rule, at least in part based on a change to membership in the dynamic address group, wherein the change to membership includes at least one of:
(1) an addition of an additional virtual machine instance to the dynamic address group; and
(2) a removal of the first virtual machine instance from the dynamic address group; and
in the event the change to the membership in the dynamic address group includes the addition of the additional virtual machine instance to the dynamic address group, applying the recompiled rule to network traffic associated with additional virtual machine instance; and
in the event the change to the membership in the dynamic address group includes removal of the first virtual machine instance from the dynamic address group, not applying the recompiled rule to network traffic associated with the first virtual machine instance; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 wherein the virtual machine information is received from an agent.
3. The system of claim 1 wherein the virtual machine information is received from a log server.
4. The system of claim 1 wherein the virtual machine information is received from a management infrastructure associated with the host machine.
5. The system of claim 1 wherein the virtual machine information is received indirectly from the host machine.
6. The system of claim 1 wherein the processor is further configured to compile the rule at least in part by substituting a dynamic group address object with an IP address of the first virtual machine instance.
7. The system of claim 1 wherein the processor is further configured to compile the rule at least in part by substituting a dynamic group address object with a set of IP addresses, wherein the set of IP addresses includes an IP address of the first virtual machine instance.
8. The system of claim 1 wherein the processor is further configured to compile the rule at least in part by substituting a dynamic group address object with a range of IP addresses, wherein the range of IP addresses encompasses an IP address of the first virtual machine instance.
9. The system of claim 1 wherein the processor is further configured to determine that the first virtual machine instance is implicated in the policy at least in part by applying a filter.
10. The system of claim 9 wherein the filter comprises an attribute included in the virtual machine information.
11. The system of claim 1 wherein the processor is further configured to receive updated virtual machine information and determine that a change associated with the first virtual machine instance has occurred.
12. The system of claim 11 wherein the host machine is a first host machine and wherein the updated information indicates that the first virtual machine instance has migrated from executing on the first host machine to executing on a second host machine.
13. The system of claim 11 wherein the updated information indicates that an IP address of the first virtual machine instance has changed.
14. A method, comprising:
receiving a rule to be applied to network traffic associated with members of a dynamic address object group;
receiving virtual machine information associated with a first virtual machine instance executing on a host machine;
determining, based at least in part on at least a portion of the received virtual machine information, that the first virtual machine instance belongs to the dynamic address group;
in response to the determination, applying the rule to network traffic associated with the first virtual machine instance;
at a time subsequent to applying the rule to network traffic associated with the first virtual machine instance, determining that the rule should be recompiled into a recompiled rule, at least in part based on a change to membership in the dynamic address group, wherein the change to membership includes at least one of:
(1) an addition of an additional virtual machine instance to the dynamic address group; and
(2) a removal of the first virtual machine instance from the dynamic address group; and
in the event the change to the membership in the dynamic address group includes the addition of the additional virtual machine instance to the dynamic address group, applying the recompiled rule to network traffic associated with additional virtual machine instance; and
in the event the change to the membership in the dynamic address group includes removal of the first virtual machine instance from the dynamic address group, not applying the recompiled rule to network traffic associated with the first virtual machine instance.
15. The method of claim 14 wherein compiling the rule includes substituting a dynamic group address object with a set of IP addresses, wherein the set of IP addresses includes an IP address of the first virtual machine instance.
16. The method of claim 14 further comprising determining whether a rule associated with the first virtual machine instance should be recompiled.
17. The method of claim 14 further comprising receiving updated virtual machine information and determining that a change associated with the first virtual machine instance has occurred.
18. The method of claim 17 wherein the host machine is a first host machine and wherein the updated information indicates that the first virtual machine instance has migrated from executing on the first host machine to executing on a second host machine.
19. A computer program product embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:
receiving a rule to be applied to network traffic associated with members of a dynamic address object group;
receiving virtual machine information associated with a first virtual machine instance executing on a host machine;
determining, based at least in part on at least a portion of the received virtual machine information, that the first virtual machine instance belongs to the dynamic address group; and
in response to the determination, applying the rule to network traffic associated with the first virtual machine instance;
at a time subsequent to applying the rule to network traffic associated with the first virtual machine instance, determining that the rule should be recompiled into a recompiled rule, at least in part based on a change to membership in the dynamic address group, wherein the change to membership includes at least one of:
(1) an addition of an additional virtual machine instance to the dynamic address group; and
(2) a removal of the first virtual machine instance from the dynamic address group; and
in the event the change to the membership in the dynamic address group includes the addition of the additional virtual machine instance to the dynamic address group, applying the recompiled rule to network traffic associated with additional virtual machine instance; and
in the event the change to the membership in the dynamic address group includes removal of the first virtual machine instance from the dynamic address group, not applying the recompiled rule to network traffic associated with the first virtual machine instance.
US14/677,858 2012-06-20 2015-04-02 Policy enforcement in a virtualized environment Active US9619260B2 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US13/528,748 US9047109B1 (en) 2012-06-20 2012-06-20 Policy enforcement in virtualized environment
US14/677,858 US9619260B2 (en) 2012-06-20 2015-04-02 Policy enforcement in a virtualized environment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US14/677,858 US9619260B2 (en) 2012-06-20 2015-04-02 Policy enforcement in a virtualized environment

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US13/528,748 Continuation US9047109B1 (en) 2012-06-20 2012-06-20 Policy enforcement in virtualized environment

Publications (2)

Publication Number Publication Date
US20150277943A1 US20150277943A1 (en) 2015-10-01
US9619260B2 true US9619260B2 (en) 2017-04-11

Family

ID=53190635

Family Applications (2)

Application Number Title Priority Date Filing Date
US13/528,748 Active 2033-03-06 US9047109B1 (en) 2012-06-20 2012-06-20 Policy enforcement in virtualized environment
US14/677,858 Active US9619260B2 (en) 2012-06-20 2015-04-02 Policy enforcement in a virtualized environment

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US13/528,748 Active 2033-03-06 US9047109B1 (en) 2012-06-20 2012-06-20 Policy enforcement in virtualized environment

Country Status (1)

Country Link
US (2) US9047109B1 (en)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10341296B2 (en) * 2013-09-13 2019-07-02 Vmware, Inc. Firewall configured with dynamic collaboration from network services in a virtual network environment
US9628550B1 (en) 2013-10-24 2017-04-18 Ca, Inc. Lightweight software management shell
US9774667B2 (en) 2013-11-08 2017-09-26 Vmware, Inc. System and method for dynamically configuring a load balancer in a virtual network environment
US9787633B2 (en) 2013-12-05 2017-10-10 Vmware, Inc. System and method for dynamically configuring a DHCP server in a virtual network environment
US9215214B2 (en) 2014-02-20 2015-12-15 Nicira, Inc. Provisioning firewall rules on a firewall enforcing device
US9680706B2 (en) 2015-06-30 2017-06-13 Nicira, Inc. Federated firewall management for moving workload across data centers
WO2017137803A1 (en) * 2016-02-10 2017-08-17 Telefonaktiebolaget Lm Ericsson (Publ) Method and network node for providing policy enforcement in a computing cloud platform
US10135727B2 (en) 2016-04-29 2018-11-20 Nicira, Inc. Address grouping for distributed service rules
US10348685B2 (en) 2016-04-29 2019-07-09 Nicira, Inc. Priority allocation for distributed service rules

Citations (40)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5968176A (en) 1997-05-29 1999-10-19 3Com Corporation Multilayer firewall system
US6453419B1 (en) 1998-03-18 2002-09-17 Secure Computing Corporation System and method for implementing a security policy
US6484261B1 (en) 1998-02-17 2002-11-19 Cisco Technology, Inc. Graphical network security policy management
US20030097589A1 (en) 2001-11-19 2003-05-22 Tuomo Syvanne Personal firewall with location detection
US20030149781A1 (en) 2001-12-04 2003-08-07 Peter Yared Distributed network identity
US6785728B1 (en) 1997-03-10 2004-08-31 David S. Schneider Distributed administration of access to information
US6826698B1 (en) 2000-09-15 2004-11-30 Networks Associates Technology, Inc. System, method and computer program product for rule based network security policies
US20050159969A1 (en) 2004-01-21 2005-07-21 Sheppard Robert F. Managing information technology (IT) infrastructure of an enterprise using a centralized logistics and management (CLAM) tool
US20050198283A1 (en) 2004-01-07 2005-09-08 Sundaresan Ramamoorthy Managing a network using generic policy definitions
US7016980B1 (en) 2000-01-18 2006-03-21 Lucent Technologies Inc. Method and apparatus for analyzing one or more firewalls
US20070005801A1 (en) 2005-06-21 2007-01-04 Sandeep Kumar Identity brokering in a network element
US7194529B2 (en) 2001-07-12 2007-03-20 Abb Inc. Method and apparatus for the delivery and integration of an asset management system into an existing enterprise network
US20070226249A1 (en) 2006-03-21 2007-09-27 Martin Kacin IT Automation Filtering And Labeling System And Appliance
US20070250424A1 (en) 2006-04-20 2007-10-25 Pravin Kothari Virtual asset groups in a compliance management system
US20080172366A1 (en) 1998-06-29 2008-07-17 Clifford Lee Hannel Query Interface to Policy Server
US20090138938A1 (en) 2007-01-31 2009-05-28 Tufin Software Technologies Ltd. System and Method for Auditing a Security Policy
US20090199177A1 (en) 2004-10-29 2009-08-06 Hewlett-Packard Development Company, L.P. Virtual computing infrastructure
US20090249472A1 (en) 2008-03-27 2009-10-01 Moshe Litvin Hierarchical firewalls
US20100107215A1 (en) 2008-10-28 2010-04-29 Yahoo! Inc. Scalable firewall policy management platform
US20100287548A1 (en) 2009-05-06 2010-11-11 Vmware, Inc. Long Distance Virtual Machine Migration
US7900005B2 (en) 2007-02-21 2011-03-01 Zimory Gmbh Method and system for the transparent migration of virtual machines storage
US20120030751A1 (en) 2010-01-30 2012-02-02 Sanchaita Datta Vpn secure sessions with dynamic ip addresses
US8185573B2 (en) 2005-02-16 2012-05-22 Nextel Communications Inc. System and method for posting a web logging message via a dispatch communication
US20120173757A1 (en) 2011-01-05 2012-07-05 International Business Machines Corporation Routing optimization for virtual machine migration between geographically remote data centers
US20120174186A1 (en) 2004-04-01 2012-07-05 Ashar Aziz Policy Based Capture with Replay to Virtual Machine
US8224918B2 (en) 2008-03-04 2012-07-17 Apple Inc. Data synchronization protocol
US20120311575A1 (en) * 2011-06-02 2012-12-06 Fujitsu Limited System and method for enforcing policies for virtual machines
US20120311568A1 (en) 2011-05-31 2012-12-06 Jansen Gerardus T Mechanism for Inter-Cloud Live Migration of Virtualization Systems
US20120317610A1 (en) * 2011-06-09 2012-12-13 International Business Machines Corporation Dynamically defining network access rules
US8341732B2 (en) 2006-01-24 2012-12-25 Citrix Systems, Inc. Methods and systems for selecting a method for execution, by a virtual machine, of an application program
US20130019277A1 (en) 2011-07-12 2013-01-17 Cisco Technology, Inc. Zone-Based Firewall Policy Model for a Virtualized Data Center
US8364852B1 (en) 2010-12-22 2013-01-29 Juniper Networks, Inc. Methods and apparatus to generate and update fibre channel firewall filter rules using address prefixes
US20130031544A1 (en) * 2011-07-27 2013-01-31 Microsoft Corporation Virtual machine migration to minimize packet loss in virtualized network
US8385519B2 (en) 2007-06-18 2013-02-26 Telefonaktiebolaget L M Ericsson (Publ) Methods and arrangements in a client and telephony server
US8413147B2 (en) 2009-07-01 2013-04-02 Huawei Technologies Co., Ltd. Method, apparatus and system for making a decision about virtual machine migration
US8495721B1 (en) 2010-06-30 2013-07-23 Google Inc. Data network security policies
US20130198808A1 (en) 2012-01-30 2013-08-01 Cisco Technology, Inc. Integrated Security Platform
US20130247207A1 (en) 2011-09-21 2013-09-19 Mcafee, Inc., A Delaware Corporation System and method for grouping computer vulnerabilities
US8566900B1 (en) 2011-05-23 2013-10-22 Palo Alto Networks, Inc. Using geographical information in policy enforcement
US8775625B2 (en) 2010-06-16 2014-07-08 Juniper Networks, Inc. Virtual machine mobility in data centers

Patent Citations (41)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6785728B1 (en) 1997-03-10 2004-08-31 David S. Schneider Distributed administration of access to information
US5968176A (en) 1997-05-29 1999-10-19 3Com Corporation Multilayer firewall system
US6484261B1 (en) 1998-02-17 2002-11-19 Cisco Technology, Inc. Graphical network security policy management
US6453419B1 (en) 1998-03-18 2002-09-17 Secure Computing Corporation System and method for implementing a security policy
US20080172366A1 (en) 1998-06-29 2008-07-17 Clifford Lee Hannel Query Interface to Policy Server
US7016980B1 (en) 2000-01-18 2006-03-21 Lucent Technologies Inc. Method and apparatus for analyzing one or more firewalls
US6826698B1 (en) 2000-09-15 2004-11-30 Networks Associates Technology, Inc. System, method and computer program product for rule based network security policies
US7194529B2 (en) 2001-07-12 2007-03-20 Abb Inc. Method and apparatus for the delivery and integration of an asset management system into an existing enterprise network
US20030097589A1 (en) 2001-11-19 2003-05-22 Tuomo Syvanne Personal firewall with location detection
US20030149781A1 (en) 2001-12-04 2003-08-07 Peter Yared Distributed network identity
US20050198283A1 (en) 2004-01-07 2005-09-08 Sundaresan Ramamoorthy Managing a network using generic policy definitions
US20050159969A1 (en) 2004-01-21 2005-07-21 Sheppard Robert F. Managing information technology (IT) infrastructure of an enterprise using a centralized logistics and management (CLAM) tool
US20120174186A1 (en) 2004-04-01 2012-07-05 Ashar Aziz Policy Based Capture with Replay to Virtual Machine
US20090199177A1 (en) 2004-10-29 2009-08-06 Hewlett-Packard Development Company, L.P. Virtual computing infrastructure
US8185573B2 (en) 2005-02-16 2012-05-22 Nextel Communications Inc. System and method for posting a web logging message via a dispatch communication
US20070005801A1 (en) 2005-06-21 2007-01-04 Sandeep Kumar Identity brokering in a network element
US8341732B2 (en) 2006-01-24 2012-12-25 Citrix Systems, Inc. Methods and systems for selecting a method for execution, by a virtual machine, of an application program
US20070226249A1 (en) 2006-03-21 2007-09-27 Martin Kacin IT Automation Filtering And Labeling System And Appliance
US20070250424A1 (en) 2006-04-20 2007-10-25 Pravin Kothari Virtual asset groups in a compliance management system
US20090138938A1 (en) 2007-01-31 2009-05-28 Tufin Software Technologies Ltd. System and Method for Auditing a Security Policy
US7900005B2 (en) 2007-02-21 2011-03-01 Zimory Gmbh Method and system for the transparent migration of virtual machines storage
US8385519B2 (en) 2007-06-18 2013-02-26 Telefonaktiebolaget L M Ericsson (Publ) Methods and arrangements in a client and telephony server
US8224918B2 (en) 2008-03-04 2012-07-17 Apple Inc. Data synchronization protocol
US20090249472A1 (en) 2008-03-27 2009-10-01 Moshe Litvin Hierarchical firewalls
US20090249438A1 (en) 2008-03-27 2009-10-01 Moshe Litvin Moving security for virtual machines
US20100107215A1 (en) 2008-10-28 2010-04-29 Yahoo! Inc. Scalable firewall policy management platform
US20100287548A1 (en) 2009-05-06 2010-11-11 Vmware, Inc. Long Distance Virtual Machine Migration
US8413147B2 (en) 2009-07-01 2013-04-02 Huawei Technologies Co., Ltd. Method, apparatus and system for making a decision about virtual machine migration
US20120030751A1 (en) 2010-01-30 2012-02-02 Sanchaita Datta Vpn secure sessions with dynamic ip addresses
US8775625B2 (en) 2010-06-16 2014-07-08 Juniper Networks, Inc. Virtual machine mobility in data centers
US8495721B1 (en) 2010-06-30 2013-07-23 Google Inc. Data network security policies
US8364852B1 (en) 2010-12-22 2013-01-29 Juniper Networks, Inc. Methods and apparatus to generate and update fibre channel firewall filter rules using address prefixes
US20120173757A1 (en) 2011-01-05 2012-07-05 International Business Machines Corporation Routing optimization for virtual machine migration between geographically remote data centers
US8566900B1 (en) 2011-05-23 2013-10-22 Palo Alto Networks, Inc. Using geographical information in policy enforcement
US20120311568A1 (en) 2011-05-31 2012-12-06 Jansen Gerardus T Mechanism for Inter-Cloud Live Migration of Virtualization Systems
US20120311575A1 (en) * 2011-06-02 2012-12-06 Fujitsu Limited System and method for enforcing policies for virtual machines
US20120317610A1 (en) * 2011-06-09 2012-12-13 International Business Machines Corporation Dynamically defining network access rules
US20130019277A1 (en) 2011-07-12 2013-01-17 Cisco Technology, Inc. Zone-Based Firewall Policy Model for a Virtualized Data Center
US20130031544A1 (en) * 2011-07-27 2013-01-31 Microsoft Corporation Virtual machine migration to minimize packet loss in virtualized network
US20130247207A1 (en) 2011-09-21 2013-09-19 Mcafee, Inc., A Delaware Corporation System and method for grouping computer vulnerabilities
US20130198808A1 (en) 2012-01-30 2013-08-01 Cisco Technology, Inc. Integrated Security Platform

Also Published As

Publication number Publication date
US20150277943A1 (en) 2015-10-01
US9047109B1 (en) 2015-06-02

Similar Documents

Publication Publication Date Title
US9578017B2 (en) Secure management of operations on protected virtual machines
US8938782B2 (en) Systems and methods for providing network access control in virtual environments
US9037775B2 (en) Network filtering in a virtualized environment
US8819832B2 (en) Systems and methods for performing vulnerability scans on virtual machines
US20160359891A1 (en) Application monitoring prioritization
US9075536B1 (en) Enhanced software application platform
Chang Towards a Big Data system disaster recovery in a Private Cloud
US20140245423A1 (en) Peripheral Firewall System for Application Protection in Cloud Computing Environments
US20140052877A1 (en) Method and apparatus for tenant programmable logical network for multi-tenancy cloud datacenters
JP6523463B2 (en) System and method for monitoring a virtual network
US8776180B2 (en) Systems and methods for using reputation scores in network services and transactions to calculate security risks to computer systems and platforms
US20150040183A1 (en) Network policy implementation for a multi-virtual machine appliance within a virtualization environment
US8707383B2 (en) Computer workload management with security policy enforcement
US9294442B1 (en) System and method for threat-driven security policy controls
CA2914802C (en) Distributed lock management in a cloud computing environment
US9613218B2 (en) Encryption system in a virtualized environment
US9766986B2 (en) Fight-through nodes with disposable virtual machines and rollback of persistent state
US9832217B2 (en) Computer implemented techniques for detecting, investigating and remediating security violations to IT infrastructure
US8583920B1 (en) Secure administration of virtual machines
AU2016235759B2 (en) Executing commands within virtual machine instances
CN105074692B (en) Using a distributed policy-based network management system model logic multi-dimensional tag
US9923928B2 (en) Automated generation of access control rules for use in a distributed network management system that uses a label-based policy model
US20130152075A1 (en) Acceleration for Virtual Bridged Hosts
US9542539B2 (en) Managing software deployment
EP3066607B1 (en) Pairing in a distributed network management system that uses a logical multi-dimensional label-based policy model

Legal Events

Date Code Title Description
STCF Information on status: patent grant

Free format text: PATENTED CASE